/Shell/Bash/Ubuntu auditd rule for PID process

Ubuntu auditd rule for PID process

# To see all syscalls made by a specific program:
sudo auditctl -a always,exit -S all -F pid=1005

#To watch a file for changes (2 ways to express):

sudo auditctl -w /etc/shadow -p wa
sudo auditctl -a always,exit -F path=/etc/shadow -F perm=wa

Source: manpages.ubuntu.com

Similar codes

0 vote213 views1 answer
How to install linux headers on arch
Shell/Bash
1 vote216 views1 answer
Git command show current repo
Shell/Bash
15 votes188 views3 answers
Nginx restart ubuntu
Shell/Bash
0 vote213 views1 answer
Git fatal "is in submodule"
Shell/Bash
3 votes204 views1 answer
Does not have a Release file. N: Updating from such a repository can't be done securely, and is therefore disabled by default. N: See apt-secure(8) manpage for repository creation and user configuration details
Shell/Bash
0 vote220 views1 answer
Ubuntu simple sh script
Shell/Bash
0 vote244 views1 answer
Kill background job
Shell/Bash
0 vote261 views1 answer
Gcloud create cluster command
Shell/Bash
1 vote194 views1 answer
Docker-compose container list
Shell/Bash
0 vote210 views1 answer
Install Lumen CSV Reader package
Shell/Bash